CVE-2026-4690 is a critical security vulnerability in Mozilla Firefox's XPCOM component caused by incorrect boundary conditions and an integer overflow. This flaw enables sandbox escape, which can allow an attacker to execute code outside the intended restricted environment. The vulnerability affects Firefox and Thunderbird prior to versions Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Mozilla has released official patches addressing this issue as part of their security advisories MFSA2026-20 and MFSA2026-21. The CVSS v3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to arbitrary code execution with elevated privileges. This compromises the security boundaries intended to isolate web content and protect the host system, resulting in high impact on confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported, but the critical CVSS score indicates a severe risk if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means. Patch status is confirmed as fixed by the vendor advisories.